Loading page
Montenegro · Mosaic of HealthDubai · Orthocure
Come possiamo aiutarti?
Questo menu indica soltanto il punto di contatto giusto: non può fornire consulenza medica. Per descrivere una patologia, usa il modulo di richiesta.
In caso di urgenza, contatta il servizio di emergenza locale.
Privacy
Only what you type into a form, and one cookie that remembers the language you chose. No analytics script, no advertising pixel, no tracker. The company that hosts the site keeps its own record of every request, and that is set out below.
Booking is not live on this site yet. Until it is, the enquiry form is the only thing here that collects personal information.
This notice covers the Zazen Health website. It does not cover the clinical records held at Mosaic of Health in Kotor or at Orthocure in Dubai. Those are separate. [REQUIRES LEGAL REVIEW]
Only what a form asks for. There is no analytics script on this site, no advertising pixel and no third-party tracker. No script here follows you to the next page.
Every field this site can store, and whether it is required.
contact_message · db/migrations/0008_contact_and_retention.sql
Written by the enquiry form on the contact page.
| What is stored | Column | Required | At the deletion date |
|---|---|---|---|
A random identifier for the record itself.Not derived from anything about you, and not reused. It is what a log line refers to when an enquiry has to be traced. | id | Recorded for you | Deleted |
Your name. | sender_name | Required | Deleted |
Your email address. | sender_email | Required | Deleted |
A telephone number, if you give one. | sender_phone | Optional | Deleted |
What you write in the message box.Free text. It is the field most likely to contain information about your health, because that is what people write there. | message | Required | Deleted |
That you ticked the consent box.The database refuses to store an enquiry without it. This is a constraint, not a setting. | consent_gdpr | Required | Deleted |
A clinic the enquiry belongs to. The column exists and is always empty.The enquiry form has no clinic selector, so nothing is ever written here. It stays listed because the column is real. | location_id | Never filled in | Deleted |
The language the page was in when you wrote. | locale | Recorded for you | Deleted |
Whether the clinic has read the enquiry and when someone dealt with it. | status, handled_at | Recorded for you | Deleted |
Whether an acknowledgement was sent.Empty. No email or messaging provider is connected to this site. | notifications | Recorded for you | Deleted |
When the enquiry arrived. | created_at | Recorded for you | Deleted |
When the record was last changed.Set by a database trigger on every update. It records that the clinic touched the record, not what was touched. | updated_at | Recorded for you | Deleted |
The date the enquiry is deleted on, written the moment it arrives. | purge_after | Recorded for you | Deleted |
appointment · db/migrations/0007_appointments.sql, amended by 0008_contact_and_retention.sql
Written by the booking flow, which is not published on this site yet.
| What is stored | Column | Required | At the deletion date |
|---|---|---|---|
A random identifier for the booking itself.Not derived from anything about the patient. It survives the stripping, because the booking survives it. | id | Recorded for you | Kept |
The patient’s name. | patient_name | Required | Cleared |
The patient’s email address. | patient_email | Required | Cleared |
A telephone number, if one is given. | patient_phone | Optional | Cleared |
The reason for the visit, in the patient’s own words.Free text, and the field most likely to contain information about health. | notes | Optional | Cleared |
Which clinic. | location_id | Required | Kept |
Which programme, or which specialty.Exactly one of the two. The database refuses a booking with both or neither. | program_id, specialty_id | One of the two | Kept |
Which clinician, if one is chosen or assigned. | doctor_id | Optional | Kept |
The date and time of the appointment. | slot_start, slot_end | Required | Kept |
That the consent box was ticked. | consent_gdpr | Required | Kept |
The language the booking was made in. | locale | Recorded for you | Kept |
Whether the appointment is pending, confirmed, cancelled or complete. | status | Recorded for you | Kept |
Whether a confirmation was sent.Empty. No email or messaging provider is connected to this site. | notifications | Recorded for you | Kept |
When the booking was made. | created_at | Recorded for you | Kept |
When the record was last changed.Set by a database trigger on every update, including the one that strips the patient details. | updated_at | Recorded for you | Kept |
The date the details are cleared on, written when the booking is made. | purge_after | Recorded for you | Kept |
When the details were cleared.Set by the sweep. A record is either intact or fully stripped; the database refuses anything in between. | anonymized_at | Recorded for you | Kept |
One job carries all of this out. It runs once a day, overnight, and acts only on the date already written on the record — it never works out a deadline of its own. Both tables are handled in a single transaction, so either the whole sweep happens or none of it does.
One cookie is set, and only if you pick a language your browser did not ask for. It is called NEXT_LOCALE, it holds a two-letter code, and it goes when you close the browser.
The site runs on Vercel, and Vercel records the address your request came from, the browser you used and the page you asked for. That happens on every visit and there is no way to turn it off from here. It is generated by the host rather than by this site. How long those records are kept, and the lawful basis for them, is [REQUIRES LEGAL REVIEW].
The link between the site and its database is encrypted and pinned to a single certificate. The fields that name a person — name, email address, telephone number, message and notes — carry no index, and there is no function on this site that searches records by person.
No name, email address, telephone number or message text is written to our logs. A submission reference and the record’s identifier are, so a fault can be traced back to the enquiry it broke on. Those log lines are held by the host and outlive the record they point at; how long for is [REQUIRES LEGAL REVIEW].
To answer the question you asked and to arrange treatment. That is the whole list. Nothing here is sold, rented or used to advertise to you.
The lawful basis for each purpose, and the further condition that applies to health information, is [REQUIRES LEGAL REVIEW].
The site runs on Vercel and its database is hosted by Railway, so both hold the information on our behalf. No email or messaging provider is connected yet. The full list of people and organisations that may read an enquiry is [REQUIRES LEGAL REVIEW].
One clinic is in Montenegro and the other is in the United Arab Emirates, so information may be handled outside the European Economic Area. Which transfer safeguards apply is [REQUIRES LEGAL REVIEW].
No decision about you is taken automatically. There is no profiling, no scoring, no automated triage. The only automatic process that touches a record is the one that deletes it.
Every record is written with a deletion date already attached to it. A scheduled job acts on that date. It is not a policy someone has to remember.
When that job runs, an enquiry is deleted outright. The whole record goes from the table, not a stripped copy of it.
A booking is stripped instead. Name, email address, telephone number and notes are cleared, and the booking itself is kept without them, so the clinic keeps its operational history and not the patient.
Whether a backup or a restore copy holds a record past its deletion date, and for how long, is [REQUIRES LEGAL REVIEW].
The job runs once a day, so a record is normally deleted within a day of its deletion date.
The periods currently set in the system are placeholders that make the mechanism testable. They are not the policy. The retention schedule for Montenegro and for the United Arab Emirates is [REQUIRES LEGAL REVIEW].
Whether a stripped booking record still counts as personal information is [REQUIRES LEGAL REVIEW].
We will answer a request to see what is held about you, to have it corrected, or to have it deleted.
Consent given through a form here can be withdrawn. Withdrawing it does not make what happened before it unlawful. [REQUIRES LEGAL REVIEW]
Which rights you actually have, whether they run wider than the three named above, whether a request can ever carry a fee, how we check who you are before answering, and how long a reply takes are [REQUIRES LEGAL REVIEW].
There is no self-service export or delete button on this site. Requests are handled by people.
The supervisory authority you can complain to is [REQUIRES LEGAL REVIEW].
One route for everything in this notice. There is no monitored address published on this site yet, so there is no way to exercise any of it. That is a defect, not a policy.
The organisation responsible for your information, its registered address and its contact details are [REQUIRES LEGAL REVIEW].
Whether a data protection officer or a representative has been appointed, and how to reach them, is [REQUIRES LEGAL REVIEW].
The inbox to send a request to is [REQUIRES LEGAL REVIEW]. It has to be published here, and read by someone, before this notice grants anything at all.
This notice was last reviewed on [REQUIRES LEGAL REVIEW].